==========================================================================
Ubuntu Security Notice USN-2281-1
July 16, 2014
linux-ec2 vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
– linux-ec2: Linux kernel for EC2
Details:
Sasha Levin reported a flaw in the Linux kernel’s point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
A flaw was discovered in the Linux kernel’s audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denial of service (OOPS). (CVE-2014-3917)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-368-ec2 2.6.32-368.84
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2281-1
CVE-2014-3917, CVE-2014-4608, CVE-2014-4943
Package Information:
https://launchpad.net/ubuntu/+source/linux-ec2/2.6.32-368.84
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJTxy1ZAAoJEAUvNnAY1cPYHPQP/jkp91ExrYVxnBB0dhHZUuJW
OY35BXAcCm7w9niu3ishLBS3JfVS45v8tz4gM9vrzVZPN4jrL3n6GQ+1NEkRSLrj
CSHVz6YlVCLIjvAV9iYn520LDvdR6P1DC1j8hP9sLXwQT+kDkyCxmc78by6KLkwm
Ndo7g6SD9uUDlKPNNc2uWBrKkNLoesDY3JZvF54+6UHnBhc88SoWaY7HsuFznp9E
OC95zzaj0xJzl5CpD5xVouXnBnfJlRxOosot00Hkwjpm8vAT/9wnPfyrfgoNS6Ej
jiwXxJfhfgK1jhpjeVne93gCBbLgpedp36YecDEOrQcvh8iw8YOA6y/0voSJ5/TF
sFee40jAKGqIZrP31TIkb3wFlWGAotg6PAtpIamhbs8DTDQ/gAaXNZaQfyumKZ1R
epMszkF6LpDdPN9o/+VKeGR7o5aJW9ZwoyMB0A/eadKhc3ONhzUlzY8DTKi3Uple
zMHkZoBd1VI4HnXytCpEPyDkV7idSkrHzDuY0oK80ghfV1FcdnOTLt6ONF7nBgie
Hit0kxg1coFu/Cq3XSdT62cTH6Gm8FrOVgQWcyRjRkx3vqyXJzZRnLcvLTmiMTYv
svxGVpRN55O5UKHpU8xo69/bW45454q2sRmvQG2tlGlfu0nm+J5EjkQ0bKCvIi3R
LVqp8+l//OpXkYLKjFCW
=xOiI
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
==========================================================================
Ubuntu Security Notice USN-2282-1
July 16, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 10.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
– linux: Linux kernel
Details:
Sasha Levin reported a flaw in the Linux kernel’s point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
A flaw was discovered in the Linux kernel’s audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denial of service (OOPS). (CVE-2014-3917)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 10.04 LTS:
linux-image-2.6.32-64-386 2.6.32-64.128
linux-image-2.6.32-64-generic 2.6.32-64.128
linux-image-2.6.32-64-generic-pae 2.6.32-64.128
linux-image-2.6.32-64-ia64 2.6.32-64.128
linux-image-2.6.32-64-lpia 2.6.32-64.128
linux-image-2.6.32-64-powerpc 2.6.32-64.128
linux-image-2.6.32-64-powerpc-smp 2.6.32-64.128
linux-image-2.6.32-64-powerpc64-smp 2.6.32-64.128
linux-image-2.6.32-64-preempt 2.6.32-64.128
linux-image-2.6.32-64-server 2.6.32-64.128
linux-image-2.6.32-64-sparc64 2.6.32-64.128
linux-image-2.6.32-64-sparc64-smp 2.6.32-64.128
linux-image-2.6.32-64-versatile 2.6.32-64.128
linux-image-2.6.32-64-virtual 2.6.32-64.128
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2282-1
CVE-2014-3917, CVE-2014-4608, CVE-2014-4943
Package Information:
https://launchpad.net/ubuntu/+source/linux/2.6.32-64.128
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJTxy1/AAoJEAUvNnAY1cPYmR4P/Ai+bUbSwdlJQIzYYG6Cz3UK
Rr/vC/ZvFiEhU2eiCS/d9GI68KuPzhZAKElgMqzSP7SbiR+JeoPB+y7sO2GPSfR+
iSMm8Yzuh6kpiIRBQcHQUAhdW11hnRd2LHV2X6Oc/3bttsOGoGwxqBatfrWsghoi
ICW3n4lJ+hEouq8AncNkvuXKRVQMgOIr7A2dwad8njJj85/f+WyWnff2LrGvtk1E
JE45h0pUq5BUzKZC991y6Nnmhg8UjY4UvZqumUOV6ND2XDq1aCD3j5TY7K9RFd12
jLMUG+UI0DLQ2IhysB2QakKpubuXm+lHRSdgkXj4pRJWc1y8iqf6Sl+uH5R9M0pS
y4BKgSXWH48oNwhKSQO7r0vFmjy3b4qjzS1lc0wVRCpagrAJe0vM/9St2YHuELG9
1EcI2AkRnpB6iLHW10SQWMPMn0JzWovuPmFRdmKK6rwjVrZw3KbaF2BKiqC0gdMQ
Q95UbFL5b/eEAdqtkMmkGOg4e9tRMZrp1E8lliOLCCdypNBCo03tXzeGmR2tTlCc
OnDL7+L9fYW9UbO8aIpoLzrAzmItTDG8f6bGg2OpNR+61iZgvXhDgSfPJAQgS4p9
61z6x5VPEwMQr+TIb+E0xR2pHEcSDlJ+g7YsNnG/9tKFM8fiWvQqTpmBYIJYbFuS
tgu/gMJdImcmj/B6Q0gb
=+R5r
—–END PGP SIGNATURE—–
—
ubuntu-security-announce mailing list
ubuntu-security-announce@lists.ubuntu.com
Modify settings or unsubscribe at: https://lists.ubuntu.com/mailman/listinfo/ubuntu-security-announce
==========================================================================
Ubuntu Security Notice USN-2283-1
July 16, 2014
linux vulnerabilities
==========================================================================
A security issue affects these releases of Ubuntu and its derivatives:
– Ubuntu 12.04 LTS
Summary:
Several security issues were fixed in the kernel.
Software Description:
– linux: Linux kernel
Details:
Sasha Levin reported a flaw in the Linux kernel’s point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel’s
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Update instructions:
The problem can be corrected by updating your system to the following
package versions:
Ubuntu 12.04 LTS:
linux-image-3.2.0-67-generic 3.2.0-67.101
linux-image-3.2.0-67-generic-pae 3.2.0-67.101
linux-image-3.2.0-67-highbank 3.2.0-67.101
linux-image-3.2.0-67-omap 3.2.0-67.101
linux-image-3.2.0-67-powerpc-smp 3.2.0-67.101
linux-image-3.2.0-67-powerpc64-smp 3.2.0-67.101
linux-image-3.2.0-67-virtual 3.2.0-67.101
After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled the standard kernel metapackages (e.g. linux-generic,
linux-server, linux-powerpc), a standard system upgrade will automatically
perform this as well.
References:
http://www.ubuntu.com/usn/usn-2283-1
CVE-2014-0131, CVE-2014-4608, CVE-2014-4943
Package Information:
https://launchpad.net/ubuntu/+source/linux/3.2.0-67.101
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIcBAEBCgAGBQJTxy4lAAoJEAUvNnAY1cPYB/QP/iDT4vEbZ9IhI4R0P8kA4atl
lHaldaZhJNl9oe/3muKu37tLkInYA2QgJ4wR97NL1WTWPUGAx9aIwsKprQdhFNW1
S7N06yTwj0XLgQawb21InEd3A8Q3bMUdoaNqvjaruD4ljsc8lsXoflx0p4el2Kxd
ix4Jk/qjInZRlRobQynu9Tf+uqUQlLnazHhn7qxySeZ5t+hzKz8rcIOyG7C8Hb3i
rkEDKo5KUBXV2klHyvbniFIisfAbftu291g1UiZ1Z4izqRK4P1kr8K4skXmYQgLf
WYZyvzuokbmZZ7C/0Qotk2qVkG3UqYZ45HT5w0HrNGgDp37yUWYufEbr6P0AXEwZ
LGHXDLeJzBuxa/CfSYzoNKm3aMzYvqR9/6UY91Is2+FZCSnELX6kNuFAfihy2pjW
s8Pwz7NEQrPhARMxpGsA60E8uI8vrAKxS0QHtq4rVGNzjp//2J1s7d2jNFbnv4n1
R/Wi3VHPKdO7ghbNlyy5ImobEOPLZhh8aRpPFp6KLCkxELYAQve4x1WedUd2gYcE
iWVRre2gWNu/tGFRvPy0ul1XINhz2IpcT+cOPP2Nm9Ejy/mjNP1wQwQqZ0AeOSKM
Q2AgBzX6ZILk6u998RJ/pzaG0Vx6KUYico/AhSuUwi9FaDLQM0bpryIpLTaDaCB7
B0ZFSFMB6i6HstEQXjQ/
=kagq
—–END PGP SIGNATURE—–
—
7e
